---
typeId: req
recordId: benac-enc-001
fields:
  title: Client-side encryption for private blobs
  statement: Benac shall support client-side encryption for private blobs before
    remote storage, replication, export, sharing, or compute staging.
  rationale: Remote storage and replication peers need not be trusted with plaintext.
  verification: Private blob uploaded to remote storage is ciphertext; authorized
    local Station decrypts and verifies.
  testable: true
  status: draft
  area: BENAC-ENC
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.6 Encryption, decryption, and disclosure control
  order: 55
---
